{"id":"RUSTSEC-2026-0373","aliases":["GHSA-x43w-36pp-96g3"],"title":"Missing case-insensitive matching for CSS url function","summary":"Missing case-insensitive matching for CSS url function","severity":"none","vendor":"ammonia","product":"ammonia","ecosystem":"rust","affected":["ammonia >= 4.2.0, < 4.2.4"],"patched":["ammonia 4.2.4"],"published":"2026-10-16","updated":"2026-10-17","sourceUpdated":"2026-10-17T15:30:02.378211969Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0373","references":[{"url":"https://crates.io/crates/ammonia"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0373.html"},{"url":"https://github.com/rust-ammonia/ammonia/pull/267"}],"tags":["osv","rust"],"ingestedAt":"2026-10-18T11:51:09.860Z","slug":"RUSTSEC-2026-0373","body":"## Overview\n\nURL filtering, such as relative URLs and URL scheme limits,\nis not always applied when CSS sanitization is used.\n\nWhen the inner URL is quoted, CSS `url(\"\")` is matched case-sensitively,\nwhen it should be matched case-insensitively.\nAs a result, while `url(\"\")` gets the intended domain name filtering,\n`URL(\"\")` does not.\n\nThe following example shows how an application needs to be configured\nto trigger this bug.\n\n```rust\nlet mut builder = Builder::new();\n// allow inline styles\nbuilder.filter_style_properties(hashset![\"background-image\"]);\nbuilder.add_generic_attributes(&[\"style\"]);\n// notice that \"http\" URLs aren't allowed\nbuilder.url_schemes([\"cid\"].into());\n\n// attacker-controlled, presumably\nlet cleaned = builder.clean(r#\"<div style='background:URL(\"https://evil.com/ping\");'>\"#);\n\n// this is the expected result\nassert_eq!(String::from(&cleaned), r#\"<div style=\"\">ok</p>\"#);\n\n// this is the result that the vulnerable version actually gets\nassert_eq!(String::from(&cleaned), r#\"<div style=\"background-image:URL(&quot;https://evil.com/ping&quot;);\">ok</p>\"#);\n```\n\nThis can be used to inject tracking pixels where the application intended to prevent them.\nIt does not allow XSS, and its usefulness for data exfiltration is limited.\n\n---\n\nThis vulnerability was reported by [Louis Li](https://github.com/zhixuli0406).\n\n## Affected packages\n\n- `ammonia >= 4.2.0, < 4.2.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ammonia 4.2.4`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}